CVE-2015-0313

Adobe Flash Player's use-after-free vulnerability allowed remote attackers to execute arbitrary code, a flaw that persisted after the product's end-of-life in 2020.

The use-after-free vulnerability in Adobe Flash Player enabled remote code execution, allowing attackers to compromise systems running the outdated software. Because Flash Player reached end-of-life in December 2020 without further patches, any remaining installations represent a perpetual security liability and a clear compliance failure under NIST 800-171 and CMMC requirements to patch known vulnerabilities. DIB organizations must ensure Flash Player is completely removed from all environments to avoid exploitation and maintain compliance.

Shame score — Adobe shipped a product with a critical remote code execution flaw that remained unpatched after the product's end-of-life, demonstrating severe negligence in maintaining a secure software supply chain.